CVE-2025-37914: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability (CVE-2025-37914) was identified in the Linux kernel's network scheduling (net_sched) component, specifically in the Enhanced Transmission Selection (ets) module. The vulnerability was discovered and reported in May 2025, affecting the ets qdisc implementation when used with netem as a child qdisc (Wiz Database, NVD).

The vulnerability occurs when a netem child qdisc makes the parent qdisc's enqueue callback reentrant. In the case of ets, this leads to a situation where the same classifier is added to the list twice, resulting in memory corruption. The issue has been assigned a CVSS score of 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) (Wiz Database).

The vulnerability can cause memory corruption in the Linux kernel when the Enhanced Transmission Selection (ets) qdisc is used with netem as a child qdisc. While this doesn't cause a Use-After-Free (UAF) condition, it does lead to memory corruption issues that could potentially result in system instability or crashes (Wiz Database).

A patch has been developed that adds additional checks to prevent the double list addition issue. The fix involves verifying whether a class is already active before adding it to the active_list, specifically addressing the reentrant case scenario. For the Debian stable distribution (bookworm), these problems have been fixed in version 6.1.140-1 (Debian Security).